Incident Record — Cryptocurrency Fraud Network: Ethereum
Ethereum Fraud — Incident Record
Advance-fee scheme using fabricated receipts and balances to induce real transfers of Ether.
1Summary
Overview of the scheme
This record documents an advance-fee cryptocurrency scam carried out between June 19 and June 23, 2026. Two actors operating under the names “Alex” and “Mandukic Mandele” presented a stream of fabricated screenshots — fake conversion rates, a fake incoming receipt, and a fake account balance — to convince R.P. that a large payout was waiting and that one more transfer would release it.
The premise was a classic bait: “send me ETH, I’ll send you USDT/USDC back in 5–10 minutes.” Acting on that promise, R.P. sent a series of small, real Ether transfers totaling approximately $200. Nothing the scammers showed in return was real. Every receipt, balance, and conversion screen was a static image with invented numbers on it; none corresponds to any transaction that exists on Ethereum. The only funds that ever moved were R.P.’s own, going out.
2The actors
Who ran the scheme
The closer
“Alex”
Supplied the receiving wallet 0x0447227f…9445c4 and ran the core pitch — send ETH now, receive USDT/USDC back in 5–10 minutes. The promised return never arrived.
The escalator
“Mandukic Mandele”
Claimed to be in Turkey; the name is fabricated. Sent the fake $1,312 USDT receipt and ran the “$23,000 unlock” and seed-phrase trap intended to capture the entire wallet.
3Timeline
What the scammers did, day by day
“Alex” sends fabricated conversion screens Fabricated
Two “converter” images are presented: $5,000 = 125 ETH and $1,000 = 26.09 ETH, framed as the current exchange rate to make a large payout look one transfer away.
Lie: impossible math. At real ETH prices these figures are off by orders of magnitude. The “converter” is a picture with numbers painted on it, not a live rate.Receiving wallet provided; the “send and you’ll get more back” loop begins
“Alex” gives the receiving address 0x0447227f…9445c4↗ and promises USDT/USDC back within 5–10 minutes. R.P. begins sending real ETH in small $20–$53 chunks to scammer-controlled wallets. No return is ever received.
The fake “+1,312.06 USDT — Completed” receipt Fabricated
A polished receipt image shows +1,312.06 USDT, “Status: Completed” arriving in R.P.’s wallet, used to signal that the return had started.
Lie: no such transaction exists. A real ERC-20 transfer is permanent and publicly visible — this one appears on Ethereum and on every chain checked. Confirmed nonexistent.The “$23,000” balance and the seed-phrase trap FabricatedSeed-phrase theft attempt
A screen displays a $23,000.00 = 5.99 ETH balance with the message “You can’t swap this to a SafePal wallet — use Trust Wallet with the same seed phrase.” The aim was to make R.P. re-enter the wallet’s recovery phrase into a wallet the scammers could drain.
Lie + theft attempt: there was never a $23,000 balance, and no legitimate wallet, swap, or exchange ever asks you to re-enter your seed phrase elsewhere. The phrase was not given.No real money ever came in — only R.P.’s ETH went out
Across the entire exchange there was zero real inbound. Every balance, receipt, and conversion was an image. The only verifiable transactions on the blockchain are R.P.’s own outbound ETH — approximately $200 — moving toward the scammer wallets documented below.
4What was fake
The fabricated artifacts
“$5,000 = 125 ETH” conversion Fabricated
Why it’s fake: impossible math. At the real ETH price, $5,000 buys a small fraction of one ETH — not 125. The figure exists only as an image used to imply a large payout was imminent.
“$1,000 = 26.09 ETH” conversion Fabricated
Why it’s fake: same impossible rate at a smaller number. $1,000 does not convert to 26 ETH at any real market price. Another static converter image, not a live quote.
“+1,312.06 USDT received — Completed” receipt Fabricated
Why it’s fake: no transaction matching this receipt exists on Ethereum or any other chain. A genuine ERC-20 transfer is recorded permanently and publicly on-chain; this one cannot be found because it never happened.
“$23,000” unlock & seed-phrase trap Fabricated
Why it’s fake: there was never a $23,000 balance to release. The screen’s instruction to “use Trust Wallet with the same seed phrase” is the actual objective — a seed-phrase theft attempt. No real wallet or exchange ever asks you to re-enter your recovery phrase elsewhere.
5The real money trail
The only real transactions — all on Ethereum
R.P. sent approximately $200 in ETH in small chunks. Those transfers are public and permanent. They flow from R.P.’s wallet, through several scammer-controlled addresses, into a consolidation wallet, and out to a centralized exchange that has not yet been identified. Every address and hash below links to its record on Etherscan.
| Step | Address / hash |
|---|---|
| Origin — R.P.’s wallet | 0xc1aa6e85a691794f5645e01a4732065f2ea336c6 |
| Scammer wallet 1 (receiving) | 0x0447227f9a532fada9332f388487a25e3b9445c4 |
| Scammer wallet 2 | 0xd28d37b611718fa220a375ac368ba6a0bb4d86ef |
| Scammer wallet 3 | 0x7cfdaca5a2588cd4ac00400a2038e8e61fe5cb39 |
| Scammer wallet 4 | 0x9844c85bd9b0c1d546e1d87f8a512a9e15bbb1ae |
| Consolidation wallet | 0x431654081084e888cb2f359a1eac7038ce48aeab |
| Cash-out | Centralized exchange — not yet identified. No exchange is named here because it has not been confirmed. |
Key transaction hash
0x8e66ff97eb0d0119caf33c5b38d8a42debbde535431ffb84f1c015f3cc00a2a5
Wallet record — real ETH leaving R.P.’s wallet
A “Send” of ETH from 0xc1aa6e85…2ea336c6 to scammer wallet 1. Unlike the screens in Section 4, this transaction is real, permanent, and verifiable on-chain — it is the actual money that moved.